Intrusion Detection and Response – Page 2

Cyber Threat Intelligence and Advisory Threat Hunting Threat Intelligence

Threat Intelligence with MISP: Part 1 – Setting up MISP with Docker

Step-by-Step Guide to Install MISP Using Docker on Ubuntu In this guide, we will walk through the steps to install the MISP (Malware Information Sharing Platform) using Docker on an Ubuntu server. Prerequisites Before we begin,…

Bharath Narayanasamy MISP, Threat Intel

Threat Hunting Threat Detection and Incident Response Understanding Log Sources

Useful Windows Event IDs

Windows System Logs Event ID 1074 (System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially…

Bharath Narayanasamy event-ids, threat_detection

Threat Detection and Incident Response Intrusion Detection and Response

Code Obfuscation and Deobfuscation

Code Obfuscation is a technique used to make a script more difficult to read by humans but allows it to function the same from a technical point of view, though performance may be slower. This is…

Bharath Narayanasamy dfir, Code

DFIR VulnLAB Threat Detection and Incident Response

Incident Response

Incident response, also known as incident handling, is a cyber security function that uses various methodologies, tools and techniques to detect and manage adversarial attacks while minimizing impact, recovery time and total operating costs. Addressing attacks…

Bharath Narayanasamy dfir, IR, Incident

Intrusion Detection and Response RESPOND

DFIR: Core Windows Processes

Reference: TryHackMe Room "Core Windows Processes" Core Windows Processes Understanding how the Windows operating system functions as a defender is vital. Task Manager doesn't show a Parent-Child process view. That is where other utilities, such as Process…

Bharath Narayanasamy dfir, memory, Volatility

SOC Analyst Threat Detection and Incident Response Intrusion Detection and Response

DFIR: Linux File System Analysis

Bharath Narayanasamy linux, incident response, detection, dfir

Splunk

Splunk SPL 101

Bharath Narayanasamy splunk, SPL

Threat Hunting Threat Detection and Incident Response Elastic SIEM

Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot

Based on the INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC module from HTB-Academy Hunting for Stuxbot The Stuxbot cybercrime group operates with a broad scope, seizing upon opportunities as they arise, without any specific targeting…

Bharath Narayanasamy Elastic, Threat_hunting

DETECT Elastic SIEM

Elastic SIEM: Developing Dashboards & Visualization

Use case 1: Failed Logon Attempts (Disabled Users) https://youtu.be/7Uyqek-FdwI Use case 2: Failed Logon Attempts (using Admin Accounts) https://youtu.be/UGRmsoqk0EM Use case 3: Successful RDP Logon Related To Service Accounts https://youtu.be/eRjA6TpEryk Use case 4: Users Added Or…

Bharath Narayanasamy Threat_hunting, SIEM, Elastic

BLUE TEAM DETECT Elastic SIEM

SIEM Use cases

How To Build SIEM Use Cases Comprehend your needs, risks, and establish alerts for monitoring all necessary systems accordingly. Determine the priority and impact, then map the alert to the kill chain or MITRE framework. Establish…

Bharath Narayanasamy SIEM, Elastic, Usecase